cybernews

CVE-2025-5125 - Owl WordPress Custom Post Carousels Featherlight Unsanitized Attribute Vulnerability

CVE ID : CVE-2025-5125
Published : June 20, 2025, 6:15 a.m. | 20 minutes ago
Description : The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 06:15:00 GMT

CVE-2025-6311 - Campcodes Sales and Inventory System SQL Injection Vulnerability

CVE ID : CVE-2025-6311
Published : June 20, 2025, 6:15 a.m. | 20 minutes ago
Description : A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/account_add.php. The manipulation of the argument id/amount leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 06:15:00 GMT

CVE-2025-6312 - Campcodes Sales and Inventory System SQL Injection Vulnerability

CVE ID : CVE-2025-6312
Published : June 20, 2025, 6:15 a.m. | 20 minutes ago
Description : A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/cash_transaction.php. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 06:15:00 GMT

CVE-2025-6307 - Code-projects Online Shoe Store SQL Injection Vulnerability

CVE ID : CVE-2025-6307
Published : June 20, 2025, 5:15 a.m. | 1 hour, 20 minutes ago
Description : A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /function/edit_customer.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 05:15:00 GMT

CVE-2025-6308 - PHPGurukul Emergency Ambulance Hiring Portal SQL Injection Vulnerability

CVE ID : CVE-2025-6308
Published : June 20, 2025, 5:15 a.m. | 1 hour, 20 minutes ago
Description : A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/bwdates-request-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 05:15:00 GMT

CVE-2025-6309 - PHPGurukul Emergency Ambulance Hiring Portal SQL Injection Vulnerability

CVE ID : CVE-2025-6309
Published : June 20, 2025, 5:15 a.m. | 1 hour, 20 minutes ago
Description : A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-ambulance.php. The manipulation of the argument ambregnum leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 05:15:00 GMT

CVE-2025-6310 - PHPGurukul Emergency Ambulance Hiring Portal SQL Injection Vulnerability

CVE ID : CVE-2025-6310
Published : June 20, 2025, 5:15 a.m. | 1 hour, 20 minutes ago
Description : A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Message leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 05:15:00 GMT

CVE-2025-6304 - Code-projects Online Shoe Store SQL Injection

CVE ID : CVE-2025-6304
Published : June 20, 2025, 4:15 a.m. | 2 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /cart.php. The manipulation of the argument qty[] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 04:15:00 GMT

CVE-2025-6305 - Code-projects Online Shoe Store SQL Injection Vulnerability

CVE ID : CVE-2025-6305
Published : June 20, 2025, 4:15 a.m. | 2 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Online Shoe Store 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_feature.php. The manipulation of the argument product_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 04:15:00 GMT

CVE-2025-6306 - Code-projects Online Shoe Store SQL Injection Vulnerability

CVE ID : CVE-2025-6306
Published : June 20, 2025, 4:15 a.m. | 2 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin_index.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 04:15:00 GMT

CVE-2025-6264 - Velociraptor Unauthorized Artifact Collection and Execution Vulnerability

CVE ID : CVE-2025-6264
Published : June 20, 2025, 3:15 a.m. | 3 hours, 20 minutes ago
Description : Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 03:15:00 GMT

CVE-2025-6299 - TOTOLINK N150RT Os Command Injection Vulnerability

CVE ID : CVE-2025-6299
Published : June 20, 2025, 3:15 a.m. | 3 hours, 20 minutes ago
Description : A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulation of the argument targetAPSsid leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 03:15:00 GMT

CVE-2025-6300 - PHPGurukul Employee Record Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6300
Published : June 20, 2025, 3:15 a.m. | 3 hours, 20 minutes ago
Description : A vulnerability classified as critical was found in PHPGurukul Employee Record Management System 1.3. This vulnerability affects unknown code of the file /admin/editempeducation.php. The manipulation of the argument yopgra leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 03:15:00 GMT

CVE-2025-6301 - PHPGurukul Notice Board System Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-6301
Published : June 20, 2025, 3:15 a.m. | 3 hours, 20 minutes ago
Description : A vulnerability, which was classified as problematic, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the file /admin/manage-notices.php of the component Add Notice. The manipulation of the argument Title/Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 03:15:00 GMT

CVE-2025-6302 - TOTOLINK EX1200T Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-6302
Published : June 20, 2025, 3:15 a.m. | 3 hours, 20 minutes ago
Description : A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Comment leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 03:15:00 GMT

CVE-2025-6303 - Code-projects Online Shoe Store SQL Injection Vulnerability

CVE ID : CVE-2025-6303
Published : June 20, 2025, 3:15 a.m. | 3 hours, 20 minutes ago
Description : A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /contactus1.php. The manipulation of the argument Message leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 03:15:00 GMT

CVE-2025-6295 - Code-projects Hostel Management System SQL Injection

CVE ID : CVE-2025-6295
Published : June 20, 2025, 2:15 a.m. | 4 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Hostel Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /allocated_rooms.php. The manipulation of the argument search_box leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 02:15:00 GMT

CVE-2025-6296 - Apache Hostel Management System SQL Injection

CVE ID : CVE-2025-6296
Published : June 20, 2025, 2:15 a.m. | 4 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Hostel Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /empty_rooms.php. The manipulation of the argument search_box leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 02:15:00 GMT

CVE-2025-48058 - PowSyBl Regular Expression Denial of Service (ReDoS)

CVE ID : CVE-2025-48058
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-49715 - Dynamics 365 Information Disclosure Vulnerability

CVE ID : CVE-2025-49715
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-6288 - PHPGurukul Bus Pass Management System Cross Site Scripting (XSS)

CVE ID : CVE-2025-6288
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php of the component Profile Page. The manipulation of the argument profile name leads to cross site scripting. The attack may be launched remotely.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-6291 - D-Link DIR-825 HTTP POST Request Handler Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-6291
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-6292 - D-Link DIR-825 HTTP POST Request Handler Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-6292
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-6293 - Code-projects Hostel Management System SQL Injection

CVE ID : CVE-2025-6293
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /contact_manager.php. The manipulation of the argument student_roll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-6294 - Code-projects Hostel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6294
Published : June 20, 2025, 1:15 a.m. | 5 hours, 20 minutes ago
Description : A vulnerability was found in code-projects Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /contact.php. The manipulation of the argument hostel_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 01:15:00 GMT

CVE-2025-47771 - PowSyBl SparseMatrix Deserialization Privilege Escalation Vulnerability

CVE ID : CVE-2025-47771
Published : June 20, 2025, 12:15 a.m. | 5 hours, 44 minutes ago
Description : PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 00:15:00 GMT

CVE-2025-6287 - PHPGurukul COVID19 Testing Management System Cross Site Scripting Vulnerability

CVE ID : CVE-2025-6287
Published : June 20, 2025, 12:15 a.m. | 5 hours, 44 minutes ago
Description : A vulnerability classified as problematic was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /test-details.php of the component Take Action. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Fri, 20 Jun 2025 00:15:00 GMT

CVE-2025-6286 - PHPGurukul COVID19 Testing Management System Open Redirect Vulnerability

CVE ID : CVE-2025-6286
Published : June 19, 2025, 11:15 p.m. | 6 hours, 44 minutes ago
Description : A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument q leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 23:15:00 GMT

CVE-2025-6283 - Xataio Xata Agent Path Traversal Vulnerability

CVE ID : CVE-2025-6283
Published : June 19, 2025, 11:15 p.m. | 6 hours, 5 minutes ago
Description : A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc. It is recommended to upgrade the affected component.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 23:15:00 GMT

CVE-2025-6284 - PHPGurukul Car Rental Portal Cross-Site Request Forgery Vulnerability

CVE ID : CVE-2025-6284
Published : June 19, 2025, 11:15 p.m. | 6 hours, 5 minutes ago
Description : A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 23:15:00 GMT

CVE-2025-6285 - PHPGurukul COVID19 Testing Management System PHP Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-6285
Published : June 19, 2025, 11:15 p.m. | 6 hours, 5 minutes ago
Description : A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unknown processing of the file /search-report-result.php. The manipulation of the argument q leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 23:15:00 GMT

CVE-2025-6282 - Xlang-ai OpenAgents Path Traversal Vulnerability

CVE ID : CVE-2025-6282
Published : June 19, 2025, 10:15 p.m. | 7 hours, 5 minutes ago
Description : A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 22:15:00 GMT

CVE-2025-47293 - PowSyBl XML Entity Injection and SSRF Vulnerability

CVE ID : CVE-2025-47293
Published : June 19, 2025, 10:15 p.m. | 5 hours, 44 minutes ago
Description : PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 22:15:00 GMT

CVE-2025-6280 - TransformerOptimus SuperAGI EmailToolKit Path Traversal Vulnerability

CVE ID : CVE-2025-6280
Published : June 19, 2025, 10:15 p.m. | 5 hours, 44 minutes ago
Description : A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 22:15:00 GMT

CVE-2025-6281 - OpenBMB XAgent Path Traversal Vulnerability

CVE ID : CVE-2025-6281
Published : June 19, 2025, 10:15 p.m. | 5 hours, 44 minutes ago
Description : A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 22:15:00 GMT

CVE-2025-6277 - Brilliance Golden Link Secondary System SQL Injection Vulnerability

CVE ID : CVE-2025-6277
Published : June 19, 2025, 9:15 p.m. | 5 hours, 20 minutes ago
Description : A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown part of the file /storagework/custTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 21:15:00 GMT

CVE-2025-6278 - Upsonic Path Traversal Vulnerability

CVE ID : CVE-2025-6278
Published : June 19, 2025, 9:15 p.m. | 5 hours, 20 minutes ago
Description : A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 21:15:00 GMT

CVE-2025-6279 - Upsonic Pickle Handler Deserialization Vulnerability

CVE ID : CVE-2025-6279
Published : June 19, 2025, 9:15 p.m. | 5 hours, 20 minutes ago
Description : A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 21:15:00 GMT

CVE-2025-6384 - CrafterCMS Groovy Sandbox Bypass Remote Code Execution

CVE ID : CVE-2025-6384
Published : June 19, 2025, 9:15 p.m. | 5 hours, 20 minutes ago
Description : Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 21:15:00 GMT

CVE-2025-6275 - WebAssembly wabt Use After Free Vuln

CVE ID : CVE-2025-6275
Published : June 19, 2025, 8:15 p.m. | 6 hours, 20 minutes ago
Description : A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 20:15:00 GMT

CVE-2025-6276 - Brilliance Golden Link Secondary System SQL Injection Vulnerability

CVE ID : CVE-2025-6276
Published : June 19, 2025, 8:15 p.m. | 6 hours, 20 minutes ago
Description : A vulnerability was found in Brilliance Golden Link Secondary System up to 20250609. It has been rated as critical. Affected by this issue is some unknown functionality of the file /storagework/rentTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 20:15:00 GMT

CVE-2025-6273 - WebAssembly wabt Reachable Assertion Vulnerability

CVE ID : CVE-2025-6273
Published : June 19, 2025, 7:15 p.m. | 6 hours, 4 minutes ago
Description : A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 19:15:00 GMT

CVE-2025-6274 - WebAssembly wabt Resource Consumption Vulnerability

CVE ID : CVE-2025-6274
Published : June 19, 2025, 7:15 p.m. | 6 hours, 4 minutes ago
Description : A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 19:15:00 GMT

CVE-2025-33117 - IBM QRadar SIEM Command Injection Vulnerability

CVE ID : CVE-2025-33117
Published : June 19, 2025, 6:15 p.m. | 7 hours, 4 minutes ago
Description : IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious autoupdate file to execute arbitrary commands.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 18:15:00 GMT

CVE-2025-33121 - IBM QRadar SIEM XXE Injection

CVE ID : CVE-2025-33121
Published : June 19, 2025, 6:15 p.m. | 7 hours, 4 minutes ago
Description : IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 18:15:00 GMT

CVE-2025-36050 - IBM QRadar SIEM Information Disclosure

CVE ID : CVE-2025-36050
Published : June 19, 2025, 6:15 p.m. | 7 hours, 4 minutes ago
Description : IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 18:15:00 GMT

CVE-2025-6271 - Swftools wav2swf Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-6271
Published : June 19, 2025, 6:15 p.m. | 7 hours, 4 minutes ago
Description : A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the library lib/wav.c of the component wav2swf. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 18:15:00 GMT

CVE-2025-6272 - wasm3 Out-of-Bounds Write Vulnerability

CVE ID : CVE-2025-6272
Published : June 19, 2025, 6:15 p.m. | 7 hours, 4 minutes ago
Description : A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_compile.c. The manipulation leads to out-of-bounds write. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 18:15:00 GMT

CVE-2025-50200 - RabbitMQ Basic Authentication Header Logging Vulnerability

CVE ID : CVE-2025-50200
Published : June 19, 2025, 5:15 p.m. | 8 hours, 4 minutes ago
Description : RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 17:15:00 GMT

CVE-2025-6270 - HDF5 Heap-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-6270
Published : June 19, 2025, 5:15 p.m. | 8 hours, 4 minutes ago
Description : A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 17:15:00 GMT

CVE-2006-2192 - CVE-2022-0001: Cisco Webex Meeting Server Integer Overflow Vulnerability

CVE ID : CVE-2006-2192
Published : June 19, 2025, 4:15 p.m. | 7 hours, 3 minutes ago
Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 16:15:00 GMT

CVE-2025-52464 - Meshtastic Public/Private Key Duplications and Low-Entropy Generation Vulnerability

CVE ID : CVE-2025-52464
Published : June 19, 2025, 4:15 p.m. | 7 hours, 3 minutes ago
Description : Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some platforms, leading to possible low-entropy key generation. When users with an affected key pair sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of compromised keys. This issue has been patched in version 2.6.11 where key generation is delayed til the first time the LoRa region is set, along with warning users when a compromised key is detected. Version 2.6.12 furthers this patch by automatically wiping known compromised keys when found. A workaround to this vulnerability involves users doing a complete device wipe to remove vendor-cloned keys.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 16:15:00 GMT

CVE-2025-6269 - HDF5 Heap-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-6269
Published : June 19, 2025, 4:15 p.m. | 7 hours, 3 minutes ago
Description : A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 16:15:00 GMT

CVE-2025-48886 - Cardano Hydra L1 Event Finality Vulnerability

CVE ID : CVE-2025-48886
Published : June 19, 2025, 3:15 p.m. | 8 hours, 3 minutes ago
Description : Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those events as finalized as soon as they are recognized by the node participants making such transactions the target of re-org attacks. The system does not currently consider the fact that failed transactions on the Cardano L1 can indeed appear in blocks because these transactions are so infrequent. This issue has been patched in version 0.22.0.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 15:15:00 GMT

CVE-2025-49014 - jq Heap Use After Free Vulnerability

CVE ID : CVE-2025-49014
Published : June 19, 2025, 3:15 p.m. | 8 hours, 3 minutes ago
Description : jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 15:15:00 GMT

CVE-2025-6268 - Luna Imaging Cross Site Scripting Vulnerability

CVE ID : CVE-2025-6268
Published : June 19, 2025, 3:15 p.m. | 8 hours, 3 minutes ago
Description : A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6. Affected is an unknown function of the file /luna/servlet/view/search. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 15:15:00 GMT

CVE-2024-24916 - Adobe Installer DLL Loading Vulnerability

CVE ID : CVE-2024-24916
Published : June 19, 2025, 2:15 p.m. | 7 hours, 38 minutes ago
Description : Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin).
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 14:15:00 GMT

CVE-2025-6267 - Zhilink ADP Application Developer Platform SQL Injection Vulnerability

CVE ID : CVE-2025-6267
Published : June 19, 2025, 2:15 p.m. | 7 hours, 38 minutes ago
Description : A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /adpweb/a/base/barcodeDetail/. The manipulation of the argument barcodeNo/barcode/itemNo leads to sql injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 14:15:00 GMT

CVE-2025-4738 - Yirmibes Software MY ERP SQL Injection

CVE ID : CVE-2025-4738
Published : June 19, 2025, 1:15 p.m. | 8 hours, 38 minutes ago
Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yirmibes Software MY ERP allows SQL Injection.This issue affects MY ERP: before 1.170.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 13:15:00 GMT

CVE-2025-6266 - FLIR AX8 Unrestricted File Upload Vulnerability

CVE ID : CVE-2025-6266
Published : June 19, 2025, 12:15 p.m. | 9 hours, 38 minutes ago
Description : A vulnerability was found in FLIR AX8 up to 1.46. It has been declared as critical. This vulnerability affects unknown code of the file /upload.php. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 12:15:00 GMT

CVE-2025-6019 - Libblockdev Polkit Local Privilege Escalation

CVE ID : CVE-2025-6019
Published : June 19, 2025, 12:15 p.m. | 9 hours, 3 minutes ago
Description : A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 12:15:00 GMT

CVE-2005-2347 - CVE-2022-1234: Apache Struts XML Entity Expansion (XXE) Vulnerability

CVE ID : CVE-2005-2347
Published : June 19, 2025, 11:15 a.m. | 10 hours, 3 minutes ago
Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 11:15:00 GMT

CVE-2025-32896 - Apache SeaTunnel Unauthenticated Arbitrary File Read and Deserialization Vulnerability

CVE ID : CVE-2025-32896
Published : June 19, 2025, 11:15 a.m. | 10 hours, 3 minutes ago
Description : # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 11:15:00 GMT

CVE-2025-5234 - WordPress Gutenverse News Plugin Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-5234
Published : June 19, 2025, 10:15 a.m. | 11 hours, 3 minutes ago
Description : The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 10:15:00 GMT

CVE-2025-31698 - Apache Traffic Server PROXY Protocol ACL IP Address Use Vulnerability

CVE ID : CVE-2025-31698
Published : June 19, 2025, 10:15 a.m. | 9 hours, 3 minutes ago
Description : ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol.  This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 10:15:00 GMT

CVE-2025-49763 - Apache Traffic Server ESI Plugin Remote Memory Consumption Vulnerability

CVE ID : CVE-2025-49763
Published : June 19, 2025, 10:15 a.m. | 9 hours, 3 minutes ago
Description : ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 10:15:00 GMT

CVE-2025-5071 - WordPress AI Engine Plugin Unauthenticated Privilege Escalation and Data Deletion Vulnerability

CVE ID : CVE-2025-5071
Published : June 19, 2025, 10:15 a.m. | 9 hours, 3 minutes ago
Description : The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 10:15:00 GMT

CVE-2016-3399 - "CVE-2022-1234: Apache HTTP Server Unauthenticated Remote Code Execution"

CVE ID : CVE-2016-3399
Published : June 19, 2025, 9:15 a.m. | 10 hours, 3 minutes ago
Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 09:15:00 GMT

CVE-2025-4571 - GiveWP - Donation Plugin and Fundraising Platform Unauthenticated Data Disclosure and Modification Vulnerability

CVE ID : CVE-2025-4571
Published : June 19, 2025, 7:15 a.m. | 10 hours, 38 minutes ago
Description : The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 07:15:00 GMT

CVE-2025-4965 - WordPress WPBakery Page Builder Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-4965
Published : June 19, 2025, 7:15 a.m. | 10 hours, 38 minutes ago
Description : The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 07:15:00 GMT

CVE-2025-5490 - WordPress Football Pool Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-5490
Published : June 19, 2025, 6:15 a.m. | 11 hours, 38 minutes ago
Description : The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 06:15:00 GMT

CVE-2025-5524 - OceanWP WordPress Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-5524
Published : June 19, 2025, 5:15 a.m. | 12 hours, 38 minutes ago
Description : The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 05:15:00 GMT

CVE-2025-52474 - WeGIA Web Manager SQL Injection Vulnerability

CVE ID : CVE-2025-52474
Published : June 19, 2025, 4:15 a.m. | 13 hours, 38 minutes ago
Description : WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. This issue has been patched in version 3.4.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 04:15:00 GMT

CVE-2025-4479 - ElementsKit Elementor Addons and Templates WordPress Stored Cross-Site Scripting

CVE ID : CVE-2025-4479
Published : June 19, 2025, 4:15 a.m. | 12 hours, 19 minutes ago
Description : The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 04:15:00 GMT

CVE-2025-50201 - WeGIA Web Manager OS Command Injection Vulnerability

CVE ID : CVE-2025-50201
Published : June 19, 2025, 4:15 a.m. | 12 hours, 19 minutes ago
Description : WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 04:15:00 GMT

CVE-2025-4367 - WordPress Download Manager Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-4367
Published : June 19, 2025, 4:15 a.m. | 11 hours, 2 minutes ago
Description : The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 04:15:00 GMT

CVE-2025-4661 - Brocade Fabric OS Path Transversal Privilege Escalation Vulnerability

CVE ID : CVE-2025-4661
Published : June 19, 2025, 3:15 a.m. | 12 hours, 2 minutes ago
Description : A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directory potentially leading to the disclosure of sensitive information. Note: Admin level privilege is required on the switch in order to exploit
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 19 Jun 2025 03:15:00 GMT

CVE-2025-50183 - OpenList Frontend Stored XSS Vulnerability

CVE ID : CVE-2025-50183
Published : June 19, 2025, 3:15 a.m. | 12 hours, 2 minutes ago
Description : OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in